[danielroe]

🔗 Linked issue

📚 Description

linked to nuxt/nuxt#36258, which gates the copies of the dev error channel that nuxt itself serves; this adds a similar isLoopbackAddress check to nuxt/cli, which is what actually governs most nuxt sessions

[pkg-pr-new]

• nuxt-cli-playground

  npm i https://pkg.pr.new/create-nuxt@1547
  

  npm i https://pkg.pr.new/nuxi@1547
  

  npm i https://pkg.pr.new/@nuxt/cli@1547
  

commit: 4f192f9

[github-actions]

CLI benchmark

@nuxt/cli v4.0.0-alpha.1 (baseline) vs v4.0.0-alpha.1 (this PR)

Metric	baseline v4.0.0-alpha.1	head v4.0.0-alpha.1	Delta
nuxt --version wall time (median)	65 ms	65 ms	-0.1%
nuxt --help wall time (median)	144 ms	144 ms	-0.2%
nuxt dev --help wall time (median)	108 ms	107 ms	-0.8%
nuxt --version modules loaded	37	37	0.0%
nuxt --help modules loaded	139	139	0.0%
nuxt dev --help modules loaded	82	82	0.0%
Installed node_modules	2.37 MB	2.37 MB	+0.1%
Published tarball (packed)	228.7 kB	229.0 kB	+0.2%

Full report

@nuxt/cli v4.0.0-alpha.1 (baseline) vs v4.0.0-alpha.1 (head)

Setting	Value
Baseline	ref:000c43c8afdd98f00f276980daef27202e0b8200 (v4.0.0-alpha.1)
Head	local packages/nuxt-cli at e0701e8 (v4.0.0-alpha.1)
Node	v24.21.0
OS	Linux 6.17.0 (kernel 6.17.0-1022-azure)
CPU	AMD EPYC 7763 64-Core Processor x 4
Memory	15.6 GB
Load average at start	0.48, 0.13, 0.04
Run started	2026-09-21T22:11:15.883Z

Cold CLI startup

Median of 15 interleaved runs per command, one warmup discarded.

Command	baseline v4.0.0-alpha.1 median	head v4.0.0-alpha.1 median	Delta	baseline v4.0.0-alpha.1 min / p95	head v4.0.0-alpha.1 min / p95
nuxt --version	65 ms	65 ms	-0.1%	62 ms / 69 ms	63 ms / 68 ms
nuxt --version (first output byte)	60 ms	60 ms	-0.5%	58 ms / 65 ms	59 ms / 64 ms
nuxt --help	144 ms	144 ms	-0.2%	139 ms / 146 ms	141 ms / 146 ms
nuxt --help (first output byte)	139 ms	138 ms	-0.1%	134 ms / 140 ms	136 ms / 141 ms
nuxt dev --help	108 ms	107 ms	-0.8%	105 ms / 110 ms	103 ms / 110 ms
nuxt dev --help (first output byte)	103 ms	102 ms	-1.3%	100 ms / 105 ms	99 ms / 105 ms
nuxt <unknown-command> (no-op)	153 ms	152 ms	-0.7%	149 ms / 156 ms	149 ms / 157 ms
nuxt <unknown-command> (no-op) (first output byte)	147 ms	147 ms	-0.6%	144 ms / 150 ms	144 ms / 151 ms

Module load cost

Counted with a module.registerHooks load hook, compile cache disabled. Counts every JS module actually evaluated on that code path (built-ins excluded, native addons excluded).

Command	baseline v4.0.0-alpha.1 modules	head v4.0.0-alpha.1 modules	Delta	baseline v4.0.0-alpha.1 source bytes	head v4.0.0-alpha.1 source bytes	Delta
nuxt --version	37	37	0.0%	302.3 kB	302.3 kB	0.0%
nuxt --help	139	139	0.0%	1.03 MB	1.03 MB	+0.1%
nuxt dev --help	82	82	0.0%	643.0 kB	644.4 kB	+0.2%

Install footprint and published tarball

Each version installed on its own into an empty project with nothing but @nuxt/cli as a dependency, so the tree is exactly the CLI and its transitive dependencies. npm cache is warm and the registry is only consulted for metadata, so install wall time is indicative, not a network benchmark.

Metric	baseline v4.0.0-alpha.1	head v4.0.0-alpha.1	Delta
Direct dependencies of @nuxt/cli	22	22	0.0%
Packages in the installed tree (unique name@version)	38	38	0.0%
Unique package names	38	38	0.0%
Package directories on disk (cross-check)	31	31	0.0%
Installed node_modules on disk	2.37 MB	2.37 MB	+0.1%
Installed files	407	407	0.0%
Install wall time (warm npm cache, median of 3)	1.27 s	1.26 s	-0.5%
Published tarball (packed)	228.7 kB	229.0 kB	+0.2%
Published tarball (unpacked)	746.9 kB	748.3 kB	+0.2%
Files in tarball	84	84	0.0%

Interleaved runs on a shared runner: trust the deltas, not the absolute timings. The dev, restart and build suites run locally via pnpm bench:cli.

[codspeed]

Merging this PR will not alter performance

✅ 2 untouched benchmarks

---

_{Comparing fix/error-channel-peer (4f192f9) with main (000c43c)}

[coderabbitai]

Understand this PR’s impact

Explore downstream dependencies and potential security impact with Blast Radius.

View blast radius →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b34ae25d-bdae-4e46-a0cb-5fdc6d2143c7

📥 Commits

Reviewing files that changed from the base of the PR and between 000c43c and 4f192f9.

📒 Files selected for processing (4)

• packages/nuxt-cli/src/dev/host-check.ts
• packages/nuxt-cli/src/dev/utils.ts
• packages/nuxt-cli/test/unit/error-channel.spec.ts
• packages/nuxt-cli/test/unit/host-check.spec.ts

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The change adds isLoopbackAddress for normalized IPv4 and IPv6 loopback detection. The dev server applies this check to error-channel requests and returns HTTP 403 for remote or missing peers. Tests cover loopback formats, remote requests, withheld reports, and local mock sockets.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description explains that the pull request adds an isLoopbackAddress check to the Nuxt CLI development error channel and relates it to the referenced Nuxt change.
Title check	✅ Passed	The title clearly and concisely states that the development error channel now requires a loopback peer.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}